Apparatus, system, and method for limiting failures in redundant signals

ABSTRACT

An apparatus, system, and method are disclosed for limiting failures in redundant signals. A coordination module generates a power status signal for each of a plurality of power modules. An input module receives a source signal. A signal generation module generates a plurality of output signals from the source signal and at least one power status signal. The output signals are not asserted if at least one power supply is operational. If a device of the signal generation module malfunctions, no more than one output signal is erroneously asserted.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to redundant signals and more particularlyrelates to limiting failures resulting from single device malfunctionsin redundant signals.

2. Description of the Related Art

The costs of losing data and mitigating data losses can be high for acritical system such as an enterprise computer system, a redundant arrayof independent disks (“RAID”) system, and a transaction processingsystem. To reduce the potential for data loss, critical systems oftenemploy a warning signal to notify a component such as a computer, a harddisk drive, a router, or the like of a state change that may affect thecomponent's function. The warning signal forewarns the component so thatthe component may take timely action to prevent data loss.

For example, certain RAID systems generate a warning signal of animminent power failure such as an early power off warning (“EPOW”)signal. A hard disk drive may receive the warning signal and in responseto the signal complete writes of data from a volatile write buffer tothe non-volatile hard disk and go off-line in advance of the powerfailure. Completing the writes prior to the power failure protects thedata in the write buffer from loss. In addition, going off-line protectsthe hard disk drive from damage or data loss when power is unavailable.

Unfortunately, if a component receives an erroneous warning signalgenerated as a result of the failure of a device generating the warningsignal, the component may take an action in response to the erroneouswarning that adversely affects the critical system. For example,conventional RAID system hard disk drives upon receiving an erroneouswarning of a power failure go off-line, reducing the redundancy of theRAID system and increasing the risk of data loss.

Critical systems typically employ a plurality of redundant components toprotect against data loss if one of the components fails. For example,if a single hard disk drive of a RAID system fails or becomesunavailable, the RAID system generally does not lose data because otherhard disk drives contain redundant data from the failed hard disk drive.Critical systems also often include redundant warning signals to limitthe consequences of erroneous warning signals. For example, certain RAIDsystems generate a distinct warning signal for each hard disk drive.Thus a first erroneous warning signal generated for a first hard diskdrive does not cause a second hard disk drive to take an adverse actionbecause the second hard disk drive expects a distinct second warningsignal.

Unfortunately, one or more devices such as arrays of semiconductor gatesor discrete electronic devices are often common to the generation of theplurality of redundant warning signals. For example, the plurality ofwarning signals may all be generated from the output of a common ANDlogic gate configured to perform a logical AND operation. If one of thecommon devices generating the redundant warning signals such as thecommon logic AND gate fails, the plurality of signals may be erroneous.As a result, a plurality of components may respond by going off-line orthe like. If the number of components responding to the erroneous signalexceeds the redundancy of the critical system, the system's data may beat risk.

For example, if two or more RAID system hard disk drives receiveerroneous warning signals indicating an imminent power failure as aresult of the failure of a common device, each hard disk drive may writebuffer data to the hard disk and go off-line. The hard disk drives goingoff-line may put all of the data of the RAID system at risk by removingthe RAID system's access to redundant data stored on the off-line harddisk drives or the system's ability to write redundant data to the harddisk drives. Thus, an erroneous warning signal may put system data atrisk by eliminating the redundancy of the RAID system.

From the foregoing discussion, it should be apparent that a need existsfor an apparatus, system, and method that limit failures in generatingredundant signals. Beneficially, such an apparatus, system, and methodwould limit the effects of device malfunctions on the generation ofredundant signals.

SUMMARY OF THE INVENTION

The present invention has been developed in response to the presentstate of the art, and in particular, in response to the problems andneeds in the art that have not yet been fully solved by currentlyavailable redundant signal generation methods. Accordingly, the presentinvention has been developed to provide an apparatus, system, and methodfor generating redundant signals that overcome many or all of theabove-discussed shortcomings in the art.

The apparatus to generate redundant signals is provided with a logicunit containing a plurality of modules configured to functionallyexecute the necessary steps of generating a power status signal,receiving a source signal, and generating output signals. These modulesin the described embodiments include a coordination module, an inputmodule, and a signal generation module.

The coordination module generates a power status signal for each of aplurality of power modules. The power modules supply power to one ormore system components. The power status signal for a power module maybe asserted if the power module is supplying power. In one embodiment,each power module includes a coordination module, an input module, and asignal generation module.

The input module receives a source signal. The source signal indicates asubsequent state change for one or more conditions such as theavailability of power on a power grid. For example, the source signalmay indicate an imminent power failure. In one embodiment, the sourcesignal precedes the state change by a specified time interval. Forexample, the source signal may indicate the power failure will occurwithin five milliseconds (5 ms).

The signal generation module generates a plurality of output signalsfrom the source signal and at least one power status signal. In oneembodiment, the output signals are EPOW signals. The output signals arenot asserted if at least one power supply is operational. A singlemalfunction of a signal generation module device results in the failureof no more than one output signal. In one embodiment, the signalgeneration module, the input module, and the coordination module arefabricated from a plurality of discrete, redundant solid-stateelectronic devices. The apparatus limits the malfunction of a singledevice to the failure of a single output signal.

A system of the present invention is also presented to generateredundant signals. The system may be embodied in a critical system suchas a RAID system. In particular, the system, in one embodiment, includesa plurality of storage devices, a controller module, a plurality ofpower modules, an input module, a coordination module, and a signalgeneration module.

The storage devices store and retrieve data. In one embodiment, thestorage devices are hard disk drives of a RAID system. The controllermodule controls the storage devices. The power modules supply power tothe storage devices. In one embodiment, the power modules convertalternating current (“AC”) power from a power grid to direct current(“DC”) power, supplying the DC power to the storage devices. In acertain embodiment, the storage devices are sufficiently powered if atleast one power module supplies power.

The coordination module generates a power status signal for each of aplurality of power modules. The input module receives a source signaland the signal generation module generates a plurality of output signalsfrom the source signal and at least one power status signal. In oneembodiment, the system further comprises one or more EPOW modules. EachEPOW module may receive the output signal and generate one or more EPOWsignals from the output signal. In one embodiment, the EPOW signalsconform to a specification for Fibre Channel EPOW signals.

In a certain embodiment, the system includes a test module. The testmodule may be configured to generate output signals in response to theassertion of one or more control signals. In addition, the test modulemay generate other signals for testing the functionality of the system.

In one embodiment, the system comprises a plurality of input modules, aplurality of coordination modules, and a plurality of signal generationmodules. The plurality of input modules, coordination modules, andsignal generation modules may be powered by a supplemental power module.The supplemental power module may power the plurality of input modules,coordination modules, and signal generation modules when each powermodule does not supply power.

A method of the present invention is also presented for generatingredundant signals. The method in the disclosed embodiments substantiallyincludes the steps necessary to carry out the functions presented abovewith respect to the operation of the described apparatus and system. Inone embodiment, the method includes generating a power status signal,receiving a source signal, and generating a plurality of output signals.

A coordination module generates a power status signal for each of aplurality of power modules. An input module receives a source signal. Asignal generation module generates a plurality of output signals fromthe source signal and at least one power status signal. In oneembodiment, a battery signal module generates a battery signal. Thebattery signal may direct a battery backup module to supply power. Inaddition, a controller signal module may generate a controller signalindicating an imminent state change such as a state change of one ormore storage devices to a controller module.

Reference throughout this specification to features, advantages, orsimilar language does not imply that all of the features and advantagesthat may be realized with the present invention should be or are in anysingle embodiment of the invention. Rather, language referring to thefeatures and advantages is understood to mean that a specific feature,advantage, or characteristic described in connection with an embodimentis included in at least one embodiment of the present invention. Thus,discussion of the features and advantages, and similar language,throughout this specification may, but do not necessarily, refer to thesame embodiment.

Furthermore, the described features, advantages, and characteristics ofthe invention may be combined in any suitable manner in one or moreembodiments. One skilled in the relevant art will recognize that theinvention can be practiced without one or more of the specific featuresor advantages of a particular embodiment. In other instances, additionalfeatures and advantages may be recognized in certain embodiments thatmay not be present in all embodiments of the invention.

The present invention reduces failures in a critical system bygenerating redundant output signals. In addition, the present inventionlimits the effects of output signal failures resulting from signalgeneration device malfunctions. These features and advantages of thepresent invention will become more fully apparent from the followingdescription and appended claims, or may be learned by the practice ofthe invention as set forth hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

In order that the advantages of the invention will be readilyunderstood, a more particular description of the invention brieflydescribed above will be rendered by reference to specific embodimentsthat are illustrated in the appended drawings. Understanding that thesedrawings depict only typical embodiments of the invention and are nottherefore to be considered to be limiting of its scope, the inventionwill be described and explained with additional specificity and detailthrough the use of the accompanying drawings, in which:

FIG. 1 is a schematic block diagram illustrating one embodiment of aredundant signal generation system in accordance with the presentinvention;

FIG. 2 is a schematic block diagram illustrating one embodiment of aredundant signal generation apparatus of the present invention;

FIG. 3 is a schematic block diagram illustrating one embodiment of adual power module redundant signal generation system of the presentinvention;

FIG. 4 is a circuit diagram illustrating one embodiment of a redundantsignal generation circuit of the present invention;

FIG. 5 is a schematic flow chart diagram illustrating one embodiment ofa redundant signal generation method in accordance with the presentinvention; and

FIG. 6 is a schematic block diagram illustrating one embodiment of asystem of a plurality of power modules of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

Many of the functional units described in this specification have beenlabeled as modules, in order to more particularly emphasize theirimplementation independence. For example, a module may be implemented asa hardware circuit comprising custom very large scale integration(“VLSI”) circuits or gate arrays, off-the-shelf semiconductors such aslogic chips, transistors, or other discrete components. A module mayalso be implemented in programmable hardware devices such as fieldprogrammable gate arrays, programmable array logic, programmable logicdevices or the like.

Modules may also be implemented in software for execution by varioustypes of processors. An identified module of executable code may, forinstance, comprise one or more physical or logical blocks of computerinstructions, which may, for instance, be organized as an object,procedure, or function. Nevertheless, the executables of an identifiedmodule need not be physically located together, but may comprisedisparate instructions stored in different locations which, when joinedlogically together, comprise the module and achieve the stated purposefor the module.

Indeed, a module of executable code may be a single instruction, or manyinstructions, and may even be distributed over several different codesegments, among different programs, and across several memory devices.Similarly, operational data may be identified and illustrated hereinwithin modules, and may be embodied in any suitable form and organizedwithin any suitable type of data structure. The operational data may becollected as a single data set, or may be distributed over differentlocations including over different storage devices, and may exist, atleast partially, merely as electronic signals on a system or network.

Reference throughout this specification to “one embodiment,” “anembodiment,” or similar language means that a particular feature,structure, or characteristic described in connection with the embodimentis included in at least one embodiment of the present invention. Thus,appearances of the phrases “in one embodiment,” “in an embodiment,” andsimilar language throughout this specification may, but do notnecessarily, all refer to the same embodiment.

Furthermore, the described features, structures, or characteristics ofthe invention may be combined in any suitable manner in one or moreembodiments. In the following description, numerous specific details areprovided, such as examples of programming, software modules, userselections, network transactions, database queries, database structures,hardware modules, hardware circuits, hardware chips, etc., to provide athorough understanding of embodiments of the invention. One skilled inthe relevant art will recognize, however, that the invention can bepracticed without one or more of the specific details, or with othermethods, components, materials, and so forth. In other instances,well-known structures, materials, or operations are not shown ordescribed in detail to avoid obscuring aspects of the invention.

FIG. 1 is a schematic block diagram illustrating one embodiment of aredundant signal generation system 100 of the present invention. Thesystem 100 includes a plurality of storage devices 150 a, 150 b, acontroller module 145, and a power module 105 having therein a pluralityof power supply modules 130 a, 130 b, an input module 185, acoordination module 110, a signal generation module 125, a test module120, and a battery signal module 135. Also shown are a battery backupmodule 155, and a plurality of EPOW modules 140.

Although the system 100 is depicted with two storage devices 150 a, 150b, one controller module 145, two power supply modules 130 a, 130 b, oneinput module 185, one coordination module 110, one signal generationmodule 125, one test module 120, one battery signal module 135, onebattery backup module 155, and two EPOW modules 140, any number ofstorage devices 150 a, 150 b, controller modules 145, power supplymodules 130 a, 130 b, input modules 185, coordination modules 110,signal generation modules 125, test modules 120, controller signalmodules 115, battery signal modules 135, battery backup modules 155, andEPOW modules 140 may be employed.

The storage devices 150 a, 150 b store and retrieve data. In oneembodiment, the storage devices 150 a, 150 b are hard disk drives of aRAID system. The controller module 145 communicates with and controlsthe storage devices 150 a, 150 b through a communication channel 190 a,190 b. In a certain embodiment, the communication channel 190 a, 190 bis a Fibre Channel Arbitrated Loop. For example, the controller module145 may communicate data to a first storage device 150 a through thecommunication channel 190 a, 190 b and the first storage device 150 astores the communicated data responsive to a controller module 145command.

The power supply modules 130 a, 130 b supply power to the storagedevices 150 a, 150 b. In one embodiment, the power supply modules 130 a,130 b convert alternating current (“AC”) power from the power grid todirect current (“DC”) power, supplying the DC power to the storagedevices 150 a, 150 b through a power boundary 160. In a certainembodiment, the storage devices 150 a, 150 b are sufficiently powered ifat least one power supply module 130 a, 130 b supplies power through thepower boundary 160. In one embodiment, the power supply modules 130 a,130 b also supply power to the coordination module 110, the controllersignal module 115, the test module 120, the signal generation module125, the input module 185, and the battery signal module 135.

The coordination module 110 generates a power status signal for each ofthe power supply modules 130 a, 130 b. Each power status signal may beasserted if the power supply module 130 a, 130 b is supplying power. Theinput module 185 receives a source signal. The source signal mayindicate a subsequent state change for one or more conditions of thesystem 100 or related devices. For example, the source signal mayindicate the failure of the power grid.

The signal generation module 125 generates a plurality of output signals165 a, 165 b from the source signal and one or more power statussignals. In one embodiment, the output signals 165 a, 165 b precede theloss of power to a power boundary 160 by five milliseconds (5 ms). Inaddition, the signal generation module 125 generates at least one powerstatus signal. The signal generation module 125, the input module 185,and the coordination module 110 are each comprised of one or moredevices such as semiconductor devices or discrete electronic devices. Amalfunction of a single signal generation module 125, input module 185,or coordination module 110 device results in the failure of no more thanone output signal 165 a, 165 b.

For example, if a device such as a device performing an AND function incooperation with other devices fails, the signal generation module 125may malfunction, generating an erroneously asserted output signal 165 a,165 b. The malfunctioning signal generation module 125 generates at mostone erroneous output signal, such as the first output signal 165 a orthe second output signal 165 b. The first and the second output signals165 a, 165 b are not both erroneously asserted.

Each EPOW module 140 receives an output signal 165 a, 165 b andgenerates one or more EPOW signals 175 from the signal generation moduleoutput signal 165 a, 165 b. In one embodiment, the EPOW signals 175conform to a specification for Fibre Channel Arbitrated Loop devicebackplanes, such as the SFF-8045 specification section 6.4.8.2 PowerFailure Warning published by the American National Standards Instituteof Washington, D.C. In the depicted embodiment, the EPOW signals 175 areused to create input signals to the storage devices 150 a, 150 b perSFF-8045 section 6.4.8.2. The input signals direct the storage devices150 a, 150 b to take action prior to a power failure.

For example, in devices such as the storage devices 150 a, 150 b thatare in compliance with SFF-8045 section 6.4.8.2, each EPOW signal 175may be used to direct the storage device 150 a, 150 b to complete theactions required to preserve the integrity of write data for transfersin progress from a write buffer to a storage media device such as a harddisk. Fibre Channel Arbitrated Loop hard disk drives with write cachingdisabled per SFF-8045 section 6.4.8.2, are required to disable theirFibre Channel ports gracefully at a Fibre Channel frame boundary andstop writing data to the non-volatile storage media at a data sectorboundary. Each EPOW signal 175 may also direct the storage device 150 a,150 b to go off-line and not accept data for storage or requests toretrieve data. In an alternate embodiment, each storage device 150 a,150 b may receive each output signal directly.

The test module 120 may generate the output signals 165 a, 165 b inresponse to the assertion of one or more test signals. In addition, thetest module 120 may generate other signals in response to the testsignals. For example, the assertion of one or more test signals maydirect the test module 120 to assert the output signals 165 a, 165 balthough the source signal is not asserted.

In one embodiment, the controller signal module 115 generates acontroller signal 170. The controller signal 170 notifies the controllermodule 145 of a change in the state of the system 100, such as a changein the storage devices 150 a, 150 b. In a certain embodiment, thecontroller signal 170 indicates an imminent change in the state of thestorage device 150 a, 150 b.

The battery signal module 135 generates a battery signal 180. In oneembodiment, the battery signal 180 notifies the battery backup module155 of a change in the state of the power grid supplying the system 100.The battery backup module 155 may prepare to supply power to one or moreelements of the system 100 in response to the battery signal 180. Thesystem 100 generates redundant output signals 165 a, 165 b and limitsthe effects of failures resulting from a redundant output signal 165 a,165 b malfunction.

FIG. 2 is a schematic block diagram illustrating one embodiment of apower module 105 used for redundant signal generation. The power module105 includes a plurality of power supply modules 130 a, 130 b, an inputmodule 185, a coordination module 110, a signal generation module 125, acontroller signal module 115, a test module 120, and a battery signalmodule 135.

In one embodiment, the signal generation module 125, the input module185, the coordination module 110, the test module 120, and thecontroller signal module 115 are fabricated of a plurality of discrete,redundant solid-state electronic devices such as discrete transistorsand the like. In an alternate embodiment, the signal generation module125, the input module 185, the coordination module 110, the test module120, and the controller signal module 115 are fabricated ofsemiconductor gate devices on a substrate.

Referring to FIGS. 1 and 2, the coordination module 110 generates apower status signal for each of a plurality of power supply modules 130a, 130 b. The power supply modules 130 a, 130 b supply power to one ormore system elements, such as storage devices 150 a, 150 b, controllermodules 145 and the like. The power status signal for a power supplymodule 130 a, 130 b may be asserted if the power supply module 130 a,130 b is supplying power. The input module 185 receives a source signal.The signal generation module 125 generates a plurality of output signals165 a, 165 b from the source signal and at least one power statussignals.

The signal generation module 125 does not assert the output signals 165a, 165 b if at least one power status signal is asserted and if thesource signal is not asserted. For example, if at least one power statussignal is asserted indicating that at least one power supply module 130a, 130 b is supplying power, and if the source signal is not asserted,indicating no imminent power grid failure, the signal generation module125 does not assert the output signals 165 a, 165 b.

The devices comprising the coordination module 110, the input module185, and the signal generation module 125 are configured such that thefailure of any one device will result in no more than one erroneousoutput signal 165 a, 165 b. For example, the malfunction of one signalgeneration module 125 may result in a failure causing one output signal165 a, 165 b to be erroneously asserted. The erroneous output signal 165a, 165 b may cause the component receiving the erroneous output signal165 a, 165 b such as a storage device 150 a, 150 b to take action inanticipation of a power failure, resulting in the storage device 150 a,150 b going off-line. The effects of the malfunction are limited to thesingle storage device 150 a, 150 b. Thus, in a RAID system with datastored redundantly on a plurality of storage devices 150 a, 150 b, forexample, one storage device 150 a, 150 b may erroneously go off-line,but the RAID system will have sufficient functioning storage devices 150a, 150 b to maintain access to all of the RAID system's data. Theapparatus 105 limits the malfunction of a single device to the failureof a single output signal 165 a, 165 b.

FIG. 3 is a schematic block diagram illustrating one embodiment of adual power module redundant signal generation system 300 of the presentinvention. The system 300 includes two power modules 105 each comprisinga coordination module 110, a controller signal module 115, a test module120, a signal generation module 125, a battery signal module 135, and aninput module 185. Although the system is depicted with two power modules105, any number of power modules 105 may be employed.

The power modules 105 supply power to a plurality of storage devices 150a, 150 b through a power boundary 160. The first power module 105 a andthe second power module 105 b may each supply sufficient power for thestorage devices 150. Each coordination module 110 generates a powerstatus signal 310 for each power module 105. Thus the first coordinationmodule 110 a generates a first power status signal 310 a for the firstpower module 105 a and communicates the first power status signal 310 ato the second power module 105 b. Similarly, the second coordinationmodule 110 b generates a second power status signal 310 b andcommunicates the second power status signal 310 b to the first powermodule 105 a.

The first and second input modules 185 a, 185 b each receive a sourcesignal. The first signal generation module 125 a generates a pluralityof output signals 165 a, 165 b from the source signal and the secondpower status signal 310 b while the second signal generation module 125b generates a plurality of output signals 165 c, 165 d from the sourcesignal and the first power status signal 310 a. Although each signalgeneration module 125 is depicted as generating two output signals 165,any number of output signals 165 may be generated.

The input module 185, coordination module 110, signal generation module125, controller signal module 115, battery signal module 135, and testmodule 120 of each power module 105 may receive power from asupplemental power module 315. In one embodiment, the battery backupmodule 155 supplies power to the supplemental power module 315. Thesystem 300 generates redundant output signals 165 from a plurality ofpower modules 105 that may be replaceable components.

FIG. 4 is a circuit diagram illustrating one embodiment of a redundantsignal generation circuit 400 of the present invention. The circuit 400is one embodiment of a power module 105 of FIGS. 1-3. The circuit 400is, in one embodiment, connected with the coordination module 110, acontroller signal module 115, a test module 120, a signal generationmodule 125, a battery signal module 135, and an input module 185 ofFIGS. 1-3.

The circuit 400 includes devices configured as AND gates 425 a, 425 b,425 c, 425 d, 425 e, 425 f OR gates 440 a, 440 b, 440 c, 440 d andinverters 430 a,b,c performing logical function on digital signals as iswell known to those skilled in the art. Although for simplicity theoutput of each AND gate 425 a,b,c,d,e,f OR gate 440 a,b,c,d and inverter430 a,b,c may be depicted as generating an output common to a pluralityof inputs from a common set of devices such as transistors orsemiconductor gates, the output of each AND gate 425 a,b,c,d,e,f, ORgate 440 a,b,c,d and inverter 430 a,b,c represents a unique output foreach input with each output generated from a set of devices unique tothe output.

For example, a first AND gate 425 a receives a power good signal 415 andan EPOW in signal 410. The power good signal 415 may indicate that apower supply module 130 is functioning. The EPOW in signal 410 may bethe source signal as described in FIGS. 1-3 and indicate a power gridfailure when asserted. The first AND gate 425 a may serve as the inputmodule 185 of FIGS. 1-3.

The first AND gate 425 a performs a plurality of logical AND operationson the power good signal 415 and the EPOW in signal 410 using a uniqueset of devices each generating a distinct output signal for each of theinputs the first AND gate 425 a drives. As depicted, the first AND gate425 a performs the AND function using seven unique sets of devices andgenerates seven distinct output signals, one each for a first OR gate440 a, a second OR gate 440 b,a second AND gate 425 b, a third AND gate425 c, a fourth AND gate 425 d, a fifth AND gate 425 e, and a sixth ANDgate 425 f.

In the depicted embodiment, the power status in signal 310 a may bereceived from a plurality of coordination modules 110. The pull downresistor 420 allows the power status in signal 310 a to be assertedshould a second power supply module 130 b be absent. The first andsecond OR gate 440 a, 440 b assert a first and second output signal 165a, 165 b if the coordination module 110 asserts a power status signal310 and the First And Gate 425 a output is low due to either the PowerGood signal 415 being de-asserted or if the EPOW In signal 410 isasserted. The first and second OR gate 440 a, 440 b may comprise thesignal generation module 125 described in FIGS. 1-3. In one embodiment,the output signals 165 are used combinatorially with additional staticlogic to complete the requirements of the ANSI fiber channelspecification SFF-8045 section 6.4.8 Dev_Ctrl_Code Function and section6.4.8.2 Power Failure Warning.

The fourth and fifth AND gate 425 d, 425 e assert a first and secondbattery signals 180 a, 180 b if: 1) the first EPOW test bit 405 a isasserted; or 2) the power good signal 415 is not asserted; or 3) theEPOW in signal 410 is asserted. Although the battery signals 180 aredepicted as comprising the battery signal zero (0) 180 a and the batterysignal one (1) 180 b, the battery signals 180 may comprise any number ofsignals. The fourth and fifth AND gate 425 d, 425 e may comprise thebattery signal module 135 described in FIGS. 1-3.

A third OR gate 440 c asserts a controller signal zero (0) 170 a if: 1)the coordination module 110 asserts a power status signal 310 a and thesecond EPOW test bit 405 b is asserted; or 2) if the power good signal415 is not asserted; or 3) the EPOW in signal 410 is asserted. A fourthOR gate 440 d asserts a controller signal one (1) 170 b if: 1) thecoordination module 110 asserts a power status signal 310 a and thethird EPOW test bit 405 c is asserted; or 2) the power good signal 415is not asserted; or 3) the EPOW in signal 410 is asserted. Although twocontroller signals 170 a, 170 b are depicted, any number of controllersignals 170 may be employed. The third and fourth OR gates 440 c, 440 dmay comprise the controller signal module 115 described in FIGS. 1-3.

The sixth AND gate 425 f asserts a power status out signal 310 b if: 1)the first EPOW test bit 405 a is asserted; or 2) the power good signal415 is not asserted; or 3) the EPOW in signal 410 is asserted. The sixthAND gate 425 f may comprise the coordination module 110 as described inFIGS. 1-3. The circuit 400 generates redundant output signals 165 a,band other control signals including battery signals 180 a,b, a powerstatus out signal 310 b, and controller signals 170 a,b.

The schematic flow chart diagrams that follow are generally set forth aslogical flow chart diagrams. As such, the depicted order and labeledsteps are indicative of one embodiment of the presented method. Othersteps and methods may be conceived that are equivalent in function,logic, or effect to one or more steps, or portions thereof, of theillustrated method. Additionally, the format and symbols employed areprovided to explain the logical steps of the method and are understoodnot to limit the scope of the method. Although various arrow types andline types may be employed in the flow chart diagrams, they areunderstood not to limit the scope of the corresponding method. Indeed,some arrows or other connectors may be used to indicate only the logicalflow of the method. For instance, an arrow may indicate a waiting ormonitoring period of unspecified duration between enumerated steps ofthe depicted method. Additionally, the order in which a particularmethod occurs may or may not strictly adhere to the order of thecorresponding steps shown. For example, the method may occur in parallelor in an alternate order.

FIG. 5 is a schematic flow chart diagram illustrating one embodiment ofa redundant signal generation method 500 in accordance with the presentinvention. Under the method 500, a coordination module 110 (of FIGS.1-4) generates 505 a power status signal 310 a,b (of FIG. 3) for each ofa plurality of power supply modules 130 (of FIGS. 1-4). An input module185 (of FIGS. 1-4) receives 510 a source signal such as an EPOW signal410 (of FIG. 4). In one embodiment, the EPOW in signal 410 indicatesthat a power grid has failed and that the failure of the power supplymodules 130 (of FIGS. 1-4) is imminent.

A signal generation module 125 (of FIGS. 1-4) generates 515 a pluralityof output signals 165 (of FIGS. 1-4) from the source signal and theplurality of power status signals 310 a,b (of FIGS. 3-4). In oneembodiment, a plurality of EPOW modules 140 (of FIGS. 1-4) generates oneor more EPOW signals 175 (of FIGS. 1-4) from each output signal 165 (ofFIGS. 1-4). In an alternate embodiment, each output signal 165 (of FIGS.1-4) functions as an EPOW signal 175 a,b (of FIGS. 1-4) for a storagedevice 150 a,b (of FIGS. 1-4).

In one embodiment, a battery signal module 135 (of FIGS. 1-4) generates520 a battery signal 180. The battery signal 180 (of FIGS. 1-4) maydirect a battery backup module 155 (of FIGS. 1-4) to supply power. Inaddition, a controller signal module 115 (of FIGS. 1-4) may generate 525a controller signal 170 (of FIGS. 1-4). The controller signal 170 (ofFIGS. 1-4) may indicate an imminent state change such as the statechange of one or more storage devices 150 a,b (of FIGS. 1-4) to acontroller module 145 (of FIGS. 1-4).

FIG. 6 is a schematic block diagram illustrating one embodiment of apower module system 600 of the present invention. The system 600includes a first and second power module 620 a,b. Each power module 620includes a twelve volt (12V) module 605, a five volt (5V) module 610 a,band a three point three volt (3.3V) module 615 a,b. FIG. 6 is given byway of example, and while each power module 620 a,b is depicted with onetwelve volt (12V) module 605 a,b, one five volt (5V) module 610 a,b, andone three point three volt (3.3V) module 615 a,b, any number of modulesand modules having different voltages and/or amperages may be employed.

The first and second twelve volt (12V) modules 605 a, 605 b, the firstand second five volt (5V) modules 610 a, 610 b, and the first and secondthree point three volt (3.3V) modules 615 a, 615 b each supply a powerboundary. For example, the twelve volt (12V) modules 605 a,b supply atwelve volt (12V) power boundary through a twelve volt (12V) out 625,the five volt (5V) modules 610 a,b supply a five volt (5V) powerboundary through a five volt (5V) out 630, and the three point threevolt (3.3V) modules 615 a,b supply a three point three volt (3.3V) powerboundary through a three point three volt (3.3V) out 635.

Each three point three volt (3.3V) module 615 a,b may supply power to aninput module 185 a,b, a coordination module 110 a,b, a signal generationmodule 125 a,b, a controller signal module 115 a,b, a test module 120a,b, and a battery signal module 135 a,b. The three point three volt(3.3) module 615 a,b may be the supplemental power module 315 describedin FIG. 3.

In one embodiment, the three point three volt (3.3V) module 615continues to supply power if the first and second power modules 620 a,620 b do not receive power from a power grid. For example, the threepoint three volt (3.3V) module 615 may receive power from a battery. Thebattery backup module 155 as described in FIGS. 1 and 3 may comprise thebattery. The input modules 185 a,b, coordination modules 110 a,b, signalgeneration modules 125 a,b, controller signal modules 115 a,b, testmodules 120 a,b, a battery signal modules 135 a,b continue to functionif one or more power modules 620 fail to receive power from the powergrid.

The present invention reduces failures in a critical system bygenerating redundant output signals 165 a,b,c, and d (of FIGS. 1-4). Theoutput signals 165 a,b,c, and d (of FIGS. 1-4) may be employed to warnof a state change such as a power failure and may be used to protectdata. In addition, the present invention is the first to limit theeffects of failures resulting from a malfunction of one devicecomprising the plurality of devices generating the redundant outputsignals 165 a,b,c, and d (of FIGS. 1-4) so that no more than one outputsignal 165 a,b,c, and d (of FIGS. 1-4) is erroneously asserted.

The present invention may be embodied in other specific forms withoutdeparting from its spirit or essential characteristics. The describedembodiments are to be considered in all respects only as illustrativeand not restrictive. The scope of the invention is, therefore, indicatedby the appended claims rather than by the foregoing description. Allchanges which come within the meaning and range of equivalency of theclaims are to be embraced within their scope.

1. An apparatus to generate redundant signals, the apparatus comprising:a coordination module configured to generate a power status signal foreach of a plurality of power modules; an input module configured toreceive a source signal; and a signal generation module configured togenerate a plurality of output signals from the source signal and atleast one power status signal, wherein the output signals are notasserted if at least one power supply is operational, and wherein asingle malfunction of a signal generation module device results in thefailure of no more than one output signal.
 2. The apparatus of claim 1,wherein the signal generation module is fabricated of plurality ofdiscrete, redundant solid-state electronic devices.
 3. The apparatus ofclaim 1, wherein each output signal is configured as an early power offwarning signal.
 4. The apparatus of claim 3, wherein the redundantoutput signal is configured as a Fibre Channel early power off warningsignal.
 5. The apparatus of claim 4, wherein the signal generationmodule communicates with a plurality of early power off warning modulesconfigured to generate a plurality of Fibre Channel early power offwarning signals from each output signal.
 6. The apparatus of claim 1,further comprising a test module configured to verify the functionalityof the signal generation module.
 7. The apparatus of claim 1, furthercomprising a battery signal module configured to generate a batterysignal configured to activate a battery backup module.
 8. The apparatusof claim 1, further comprising a controller signal module configured togenerate a controller signal configured to notify a controller module ofa change in a storage device state.
 9. The apparatus of claim 1, furthercomprising a plurality of input modules, a plurality of coordinationmodules, and a plurality of signal generation modules each powered by asupplemental power module.
 10. An apparatus to generate redundantsignals, the apparatus comprising: a plurality of power sensorsconfigured to detect an active power line; an input module configured toreceive a source signal; a signal generation module configured togenerate a plurality of output signals from the source signal and atleast one detected active power line, wherein the output signals are notasserted if at least one power line is operational, and wherein a singlemalfunction of a signal generation module device results in the failureof no more than one output signal.
 11. A system to generate redundantsignals, the system comprising: a plurality of storage devices; acontroller module configured to control the storage devices; a pluralityof power modules configured to power the storage devices; an inputmodule configured to receive a source signal; a coordination moduleconfigured to generate a power status signal for each power module; anda signal generation module configured to generate a plurality of outputsignals from the source signal and at least one power status signal,wherein each output signal is in communication with one storage device,the output signals are not asserted if at least one power supply isoperational, and wherein a single malfunction of a signal generationmodule device results in the failure of no more than one output signal.12. The system of claim 11, wherein the signal generation module isfabricated of a plurality of discrete, redundant solid-state electronicdevices.
 13. The system of claim 11, wherein each output signal isconfigured as an early power off warning signal.
 14. The system of claim13, wherein each output signal is configured as a Fibre Channel earlypower off warning signal.
 15. The system of claim 14, further comprisinga plurality of early power off warning modules configured to generate aplurality of Fibre Channel early power off warning signals from eachoutput signal.
 16. The system of claim 11, further comprising aplurality of input modules, a plurality of coordination modules, and aplurality of signal generation modules each powered by a supplementalpower module.
 17. The system of claim 11, further comprising a testmodule configured to verify the functionality of the signal generationmodule.
 18. The system of claim 11, further comprising a battery signalmodule configured to generate a battery signal configured to activate abattery backup module.
 19. The system of claim 11, further comprising acontroller signal module configured to generate a controller signalconfigured to notify the controller module of a change in the storagedevice state.
 20. A method for generating redundant signals, the methodcomprising: generating a power status signal for each of a plurality ofpower modules; receiving a source signal; and generating a plurality ofoutput signals from the source signal and at least one power statussignal, wherein the output signals are not asserted if at least onepower supply is operational, and wherein a single malfunction of asignal generation module device results in the failure of no more thanone output signal.
 21. The method of claim 20, wherein the outputsignals are generated by a plurality of discrete, redundant solid-stateelectronic devices.
 22. The method of claim 20, wherein each outputsignal is configured as an early power off warning signal.
 23. Themethod of claim 22, further comprising generating a plurality of FibreChannel early power off warning signals from each output signal.
 24. Themethod of claim 20, further comprising verifying the functionality ofthe power status signal generation means, the source signal receivingmeans, and the output signal generation means.
 25. The method of claim20, further comprising generating a battery signal configured toactivate a battery backup module.
 26. The method of claim 20, furthercomprising generating a controller signal configured to notify acontroller module of a change in a storage device state.
 27. The methodof claim 20, further comprising providing a supplemental power sourcefor the power status signal generation means, the source signalreceiving means, and the output signal generation means.
 28. A methodfor generating redundant signals, the method comprising: controlling aplurality of storage devices; generating a power status signal for eachof a plurality of power modules configured to power the storage devices;receiving a source signal; and generating a plurality of output signalsfrom the source signal and at least one power status signal, wherein theoutput signals are not asserted if at least one power supply isoperational, and wherein a single malfunction of a signal generationmodule device results in the failure of no more than one output signal.29. The method of claim 28, wherein the output signals are generated bya plurality of discrete, redundant solid-state electronic devices. 30.An apparatus to generate redundant signals, the apparatus comprising:means for generating a power status signal for each of a plurality ofpower modules; means for receiving a source signal; means for generatinga plurality of output signals from the source signal and at least onepower status signal, wherein the output signals are not asserted if onepower supply is operational, and wherein a malfunction of a signalgeneration module device results in the failure of no more than oneoutput signal.